Monitor pack for monitor Solution 6 (conversion to monitor Solution 7 in progress)

Windows NT and Windows 2000 include the ability to log the creation and destruction of each process on the system. To enable this feature, set the system's Audit policy to audit success and failure events in the "Detailed Tracking" category.

592 A new process has been created
593 A process has exited
594 A handle to an object has been duplicated
595 Indirect access to an object has been obtained